Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Does anyone have a working implementation using keyfiles, preferably on SD Card, instead of a prompt for ZFS? I know how to do this with linux LVM/LUKS. In my opinion the FreeBSD full disk encryption solutions are WAY more secure, but I would really like to use keyfiles instead of getting prompted during boot.

I can't find a way to do it with google-magic.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

You have to create your key first. ZFS supports two types of file based keys. Hex, and raw. For this you can use openssl to generate the key.

openssl rand -out /media/stick/key 16

The 16 creates a 16-byte (i.e., 128-bit) key. For a 192-bit or 256-bit key use 24 or 32 respectively.

Then create your dataset as you normally would, specifying the key.

zfs create -o encryption=on -o keysource=raw,file:///media/stick/key rpool/encrypted

You can also use the -hex flag to openssl rand and keysource=hex for a human readable hex value in the file.

share|improve this answer
    
Thank you. You have been most helpful. Once I get it tested and working on my particular implementation I'll hit check. Again, thanks. –  hbdgaf Aug 19 '11 at 17:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.